Track Implementation of NPM "RFC for linking packages to their source and build"

[achrinza]

See: npm/rfcs#626

#todo: add description linking RFC to the LoopBack project.

[achrinza]

Not sure if it's the same thing, but NPM Provenance was recently announced & currently supports GitHub Actions. However, the NPM docs explicitly rule out support for Lerna.

see: https://github.blog/2023-04-19-introducing-npm-package-provenance/
see: https://docs.npmjs.com/generating-provenance-statements (Git Permalink)

[achrinza]

the NPM docs explicitly rule out support for Lerna.

Lerna now has explicit support:

• Custom npm publish commands (provenance?) lerna/lerna#3657 (comment)
• chore: lerna supports provenance npm/documentation#629